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1. Establishes a provably-correct framework for the 

systematic encoding of safety specifications into 
the spacecraft trajectory generation process 

2. Derives an efficient one-burn escape maneuver 
policy for proximity operations near circular orbit 
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Spacecraft rendezvous approaches with explicit 
characterizations of safety: 

• Kinematic path optimization [Jacobsen, Lee, et at., 

2002 ] 

• Artificial potential functions [Roger and Mclnnes, 

2000 ] 

• MILP formulations [Breger and How, 2008] 

• Safety ellipses [Gay lor and Barbee, 2007] [Naasz, 
2005] 

• Motion planning [Frazzoli, 2003] 

• Robust Model-Predictive Control [Carson, 
Acikmese, et at., 2008] 

• Forced equilibria [Weiss, Baldwin, et at., 2013] 


Types of Spacecraft Rendezvous Safety 


• Passive Trajectory Protection: Constrain 
coasting trajectories to avoid collisions up to a 
given horizon time 

• Active Trajectory Protection: Implement an 
actuated escape maneuver to save/abort a mission 
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Examples: 

• Rovers/Land vehicles: Come to a complete stop 

• Manipulators: Return to previous configuration, 
disengage, or execute emergency plan 

• UAV's: Enter a safe loiter pattern 

• Spacecraft: Less straightforward; generally require 
mission-specific solutions (with human oversight) 
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A state is safe if and only if there exists, under all 
failure conditions, a safe, dynamically-feasible 
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tf,x(t),u(t) 

J( x ,u, t) 
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subject to 

±(t) = f(x(t),u(t),t) 
x(to) = X 0 

(Dynamics) 

(Initial Condition) 
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x(tf) C ^invariant 

(Invariant Termination) 

Constraints 
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U(t) G Wfail(xo) 

(Control Admissibility) 

Numerical 
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(Inequality Constraints) 

Conclusions 


fy(x,u) = 0,7 = [ 1 ,...,< 7 ] 

(Equality Constraints) 

10/20 


Challenge: Solving the Finite-Time Safety 
Problem under Failures 


For a AC-fault tolerant spacecraft with N control 
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Idea: Simplify the Finite-Time Safety Problem 


Theorem (Sufficient Fault-Tolerant Active Safety) 


1. From each x(tj a ^), prescribe a Collision-Avoidance 
Maneuver \~\cam{x) that gives a horizon T and 
escape sequence u that satisfies x(T) E X 'invariant 
and u(r) C U for all tf a u < r < T . 


2. For each failure mode Uf a ii{^{tf ai i)) C ZY(x(t /az7 )) 
up to tolerance K, check if u = F1c/\m(x) C Uf a n - 
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1. From each x(fy a * i), prescribe a Collision-Avoidance 
Maneuver l~l c/\/w( x ) that gives a horizon T and 
escape sequence u that satisfies x(7~) G X, invariant 
and u(r) C U for all tf a u < r < T. 

Barbee, M. Pavone 

■ -- 

1 

Spacecraft Safety 

Artiv/e Safety with 
Positively-lnvariant Set 

2. For each failure mode Uf ai i(x:(tf a ii)) C U(yL(t fai i )) 
up to tolerance K, check if u = l~l c/\/w( x ) C Uf a %i ■ 

CWH CAM Policy Design 

'■■‘2 ■ Numerical 
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■ Con elusions 

Key Simplifications 

Removes decision variables u, reducing to: 

• a test of escape control feasibility under failure(s) 

• numerical integration for satisfaction of dynamics 

• an a posteriori check of constraints g / and hj 
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Incorporating Safety Constraints: 

• Add CAM policy generation to sampling algorithm 

• Include CAM-trajectory collision-checking in tests 
of sample feasibility 
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Circular Clohessy-Wiltshire-Hill (CWH) CAM policy: 

1. Coast from x(t) to some new T > t such that 
x( T~) lies at a position in Ai nvariant . 

2. Circularize the orbit at x(7~) such that 

^ ^invariant 

3. Coast along the new orbit (horizontal drift along 
the in-track axis) in ^variant 


Example: CAM Policy Design 

Choosing the Circularization Time, T 
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minimize Av ( ? irc (T) 
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(Dynamics) 
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Key Result 

Can be reduced to an analytical expression that is 
solvable in milliseconds 
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• Calls on the Fast Marching Tree (FMT*) algorithm 
for implementation 
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\|7 

Conclusions 

• The target is nadir-pointing 


Future Goals 
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• Simulates an automated approach to LandSat-7 

( e.g for servicing) between pre-specified waypoints 

• Calls on the Fast Marching Tree (FMT*) algorithm 
for implementation 

Constraints: 

• Plume impingement: No 

exhaust plume impingement 

• Collision avoidance: 

Clearance of an elliptic 
Keep-Out Zone (KOZ) 

• Target communication: 

Target comm lobe avoidance 

• Safety: Two-fault tolerance to 
stuck-off failures 
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probability, computed over 50 trials: 
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1. Use termination constraints inside safe, stable, 
positively-invariant sets for infinite-horizon 
maneuver safety 

2. Embed invariant-set constraints into 
sampling-based algorithms for safety-constrained 
planning 


Synopsis 

• Demonstrated the idea for failure-tolerant circular 
CWH planning 

• CAM policies can be precomputed offline for more 
efficient online computation 


Future Work 


Future Goals 

• Extend to thruster 
stuck-on and 
mis-allocation failures 

• Account for localization 
uncertainty 

• Apply these notions to 
small-body proximity 
operations 
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Thank you! 


Joseph A. Starek, Brent W. Barbee, and 
Marco Pavone 

Aeronautics & Astronautics Navigation and Mission Design 
Stanford University NASA GSFC 

jstarek@stanford.edu 


Clohessy-Wiltshire-Hill (CWH) Equations 


ASH 


Sampling-Based 
Spacecraft Safety 



J. Starek, B. 
Barbee, M. Pavone 

Dynamics 

Sampling-Based 
Motion Planning 

Optimal Motion Planning 
FMT* 


• Yields LTI dynamics: 
x = Ax + Bu 
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Generalized Mover’s Problem 
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Definition (Optimal Motion Planning Problem) 
Given X, <Y 0 b s , djf ree , and J, find an action trajectory 


u : [0, T\ U yielding a feasible path x(t) G Af ree 
over time horizon t G [0, 7~] f which reaches the goal 
region x(7~) G Af goa i and minimizes the cost functional 
J = Io C(x(t),u(t))dt. 


Dynamics 
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Optimal Motion Planning 
FMT* 


Characteristics: 

• PSPACE-hard (and therefore NP-hard) 

• Requires kinodynamic motion planning 

• Almost certainly requires approximate algorithms, 
tailored to the particular application 
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